# Reproduce the redaction example

Original code: MIT. Observations and worksheet: CC BY 4.0.

Use Node.js 24.19.0 (official tag source commit `cdc1b38d40cb567b7ad0b39c86addf830a0af0ae`). From this directory:

```sh
node test.mjs
```

The test imports `redact.mjs`, whose bytes are printed on the article. It runs twenty-one synthetic accepted cases and six refused inputs. No network API is called. All example names are reserved. The output asserts removal of the declared synthetic values, duplicate-name preservation and refusal behavior, not detection of every possible secret.

The function preserves hostnames and sixteen allowlisted parameter names. Value-less query items become opaque markers, unknown query names are replaced, and fragments outside the strict short approved name=value grammar are removed as a whole. Review hostnames and remaining context manually. Path segments are replaced after URL normalization, so output is not an exact reconstruction and cannot be used to verify a signature. The record at `../../measurements/P11-redaction.json` gives the runtime hash, exact inputs and source hashes. The runtime reported its release version; a reproducible binary build was not independently attested. The superseded P9 record is retained at `../../measurements/earlier-runs/P9/P11-redaction.json`, with its exact sources under `earlier-P9/`; do not use that old redactor.